```html
<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>MyBatis参数处理解析 | 技术小馆</title>
    <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/6.4.0/css/all.min.css">
    <link rel="stylesheet" href="https://cdn.staticfile.org/tailwindcss/2.2.19/tailwind.min.css">
    <link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;700&display=swap" rel="stylesheet">
    <script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
    <style>
        body {
            font-family: 'Noto Sans SC', Tahoma, Arial, Roboto, "Droid Sans", "Helvetica Neue", "Droid Sans Fallback", "Heiti SC", "Hiragino Sans GB", Simsun, sans-serif;
            color: #333;
            line-height: 1.6;
        }
        .heading-font {
            font-family: 'Noto Serif SC', serif;
        }
        .code-block {
            background-color: #282c34;
            color: #abb2bf;
            border-radius: 8px;
            padding: 1.5rem;
            position: relative;
            overflow: hidden;
        }
        .code-copy {
            position: absolute;
            top: 0.5rem;
            right: 0.5rem;
            color: rgba(255,255,255,0.5);
            cursor: pointer;
            transition: all 0.2s;
        }
        .code-copy:hover {
            color: white;
        }
        .comparison-card {
            transition: all 0.3s ease;
            border-radius: 12px;
            overflow: hidden;
            box-shadow: 0 4px 6px rgba(0, 0, 0, 0.05);
        }
        .comparison-card:hover {
            transform: translateY(-5px);
            box-shadow: 0 10px 15px rgba(0, 0, 0, 0.1);
        }
        .mermaid {
            background-color: white;
            padding: 1.5rem;
            border-radius: 12px;
            box-shadow: 0 4px 6px rgba(0, 0, 0, 0.05);
        }
        .highlight {
            background: linear-gradient(90deg, rgba(253,230,138,0.5) 0%, rgba(254,240,138,0) 100%);
            padding: 0.2rem 0.4rem;
            border-radius: 4px;
        }
    </style>
</head>
<body class="bg-gray-50">
    <!-- Hero Section -->
    <section class="relative bg-gradient-to-r from-blue-600 to-indigo-800 text-white py-20 md:py-28">
        <div class="container mx-auto px-6 max-w-4xl">
            <div class="flex flex-col items-center text-center">
                <h1 class="heading-font text-4xl md:text-5xl font-bold mb-4 leading-tight">
                    MyBatis参数处理深度解析
                </h1>
                <p class="text-xl md:text-2xl text-blue-100 max-w-3xl mb-8">
                    <i class="fas fa-quote-left mr-2 text-blue-200"></i>
                    #{}与${}的区别与最佳实践指南
                    <i class="fas fa-quote-right ml-2 text-blue-200"></i>
                </p>
                <div class="flex space-x-4">
                    <span class="px-4 py-2 bg-white bg-opacity-10 rounded-full text-sm font-medium">#MyBatis</span>
                    <span class="px-4 py-2 bg-white bg-opacity-10 rounded-full text-sm font-medium">#SQL注入</span>
                    <span class="px-4 py-2 bg-white bg-opacity-10 rounded-full text-sm font-medium">#ORM框架</span>
                </div>
            </div>
        </div>
        <div class="absolute bottom-0 left-0 right-0 h-16 bg-gradient-to-t from-gray-50 to-transparent"></div>
    </section>

    <!-- Main Content -->
    <main class="container mx-auto px-6 max-w-4xl py-12 relative">
        <!-- Introduction -->
        <section class="mb-16">
            <p class="text-lg text-gray-700 mb-8 leading-relaxed">
                在MyBatis中，<span class="highlight font-bold">#{}和${}</span>是两种不同的参数处理方式，它们的主要区别在于SQL的预处理和参数的转义处理。理解它们的区别对于编写安全高效的MyBatis查询至关重要。
            </p>
            
            <div class="grid md:grid-cols-2 gap-8 mb-12">
                <!-- #{} Card -->
                <div class="comparison-card bg-white p-6 border-l-4 border-green-500">
                    <div class="flex items-center mb-4">
                        <div class="w-10 h-10 rounded-full bg-green-100 text-green-600 flex items-center justify-center mr-3">
                            <i class="fas fa-shield-alt"></i>
                        </div>
                        <h3 class="heading-font text-xl font-bold text-gray-800">#{} 参数预处理</h3>
                    </div>
                    <p class="text-gray-600 mb-4">
                        <span class="highlight font-bold">#{}</span>用于处理动态SQL的参数，在SQL语句中以占位符的形式表示。MyBatis会进行参数值的预处理和转义，防止SQL注入攻击。
                    </p>
                    <div class="code-block mt-4">
                        <div class="code-copy" onclick="copyCode(this)"><i class="far fa-copy"></i></div>
                        <pre><code class="language-xml">&lt;select id="getUserById" resultMap="userMap"&gt;
  select * from t_User where id = #{id}
&lt;/select&gt;</code></pre>
                    </div>
                    <div class="mt-4 p-4 bg-green-50 rounded-lg">
                        <div class="flex items-start">
                            <div class="flex-shrink-0 text-green-500 mr-2 mt-1">
                                <i class="fas fa-check-circle"></i>
                            </div>
                            <p class="text-sm text-green-700">
                                其中的<span class="font-bold">#{id}</span>会被预处理为参数化查询，安全地传递给数据库执行。
                            </p>
                        </div>
                    </div>
                </div>

                <!-- ${} Card -->
                <div class="comparison-card bg-white p-6 border-l-4 border-red-500">
                    <div class="flex items-center mb-4">
                        <div class="w-10 h-10 rounded-full bg-red-100 text-red-600 flex items-center justify-center mr-3">
                            <i class="fas fa-exclamation-triangle"></i>
                        </div>
                        <h3 class="heading-font text-xl font-bold text-gray-800">${} 字符串替换</h3>
                    </div>
                    <p class="text-gray-600 mb-4">
                        <span class="highlight font-bold">${}</span>直接将参数值拼接到SQL语句中，不进行预处理或转义，可能存在SQL注入风险。
                    </p>
                    <div class="code-block mt-4">
                        <div class="code-copy" onclick="copyCode(this)"><i class="far fa-copy"></i></div>
                        <pre><code class="language-xml">&lt;select id="getUserById" resultMap="userMap"&gt;
  select * from t_User where id = ${id}
&lt;/select&gt;</code></pre>
                    </div>
                    <div class="mt-4 p-4 bg-red-50 rounded-lg">
                        <div class="flex items-start">
                            <div class="flex-shrink-0 text-red-500 mr-2 mt-1">
                                <i class="fas fa-exclamation-circle"></i>
                            </div>
                            <p class="text-sm text-red-700">
                                其中的<span class="font-bold">${id}</span>会直接被替换为参数值，可能导致SQL注入漏洞。
                            </p>
                        </div>
                    </div>
                </div>
            </div>

            <div class="bg-white rounded-xl shadow-sm p-6 mb-8">
                <h3 class="heading-font text-2xl font-bold text-gray-800 mb-4">解析后的SQL对比</h3>
                <div class="grid md:grid-cols-2 gap-6">
                    <div class="border border-gray-200 rounded-lg overflow-hidden">
                        <div class="bg-gray-100 px-4 py-2 border-b border-gray-200">
                            <h4 class="font-medium text-gray-700">#{} 预处理方式</h4>
                        </div>
                        <div class="p-4">
                            <img src="https://cdn.nlark.com/yuque/0/2021/png/21449790/1636422557530-19353e23-57a1-42a1-8957-aaf6560810e3.png" alt="#{}预处理SQL示例" class="rounded shadow-sm w-full">
                        </div>
                    </div>
                    <div class="border border-gray-200 rounded-lg overflow-hidden">
                        <div class="bg-gray-100 px-4 py-2 border-b border-gray-200">
                            <h4 class="font-medium text-gray-700">${} 字符串替换方式</h4>
                        </div>
                        <div class="p-4">
                            <img src="https://cdn.nlark.com/yuque/0/2021/png/21449790/1636422579160-1c73532f-0307-4eb7-9a44-9714d3aec970.png" alt="${}字符串替换SQL示例" class="rounded shadow-sm w-full">
                        </div>
                    </div>
                </div>
            </div>
        </section>

        <!-- Key Differences -->
        <section class="mb-16">
            <h2 class="heading-font text-3xl font-bold text-gray-800 mb-6 pb-2 border-b border-gray-200">核心区别与最佳实践</h2>
            
            <div class="mermaid mb-8">
                graph TD
                    A[MyBatis参数处理] --> B[#{} 预处理]
                    A --> C[${} 字符串替换]
                    B --> D[使用PreparedStatement]
                    B --> E[自动参数转义]
                    B --> F[防止SQL注入]
                    C --> G[直接字符串拼接]
                    C --> H[无参数转义]
                    C --> I[有SQL注入风险]
                    D --> J[安全]
                    I --> K[不安全]
            </div>

            <div class="bg-white rounded-xl shadow-sm p-6">
                <h3 class="heading-font text-xl font-bold text-gray-800 mb-4">关键区别总结</h3>
                <ul class="space-y-4">
                    <li class="flex items-start">
                        <div class="flex-shrink-0 h-6 w-6 rounded-full bg-blue-100 text-blue-600 flex items-center justify-center mr-3">
                            <i class="fas fa-shield-alt text-sm"></i>
                        </div>
                        <p class="text-gray-700">
                            <span class="font-bold text-blue-600">#{}</span> 是参数预处理方式，会进行参数值的预处理和转义，安全性更高，能够有效防止SQL注入攻击。
                        </p>
                    </li>
                    <li class="flex items-start">
                        <div class="flex-shrink-0 h-6 w-6 rounded-full bg-red-100 text-red-600 flex items-center justify-center mr-3">
                            <i class="fas fa-exclamation-triangle text-sm"></i>
                        </div>
                        <p class="text-gray-700">
                            <span class="font-bold text-red-600">${}</span> 是参数字符串替换方式，会直接将参数值的字符串形式拼接到SQL语句中，存在SQL注入攻击的风险。
                        </p>
                    </li>
                    <li class="flex items-start">
                        <div class="flex-shrink-0 h-6 w-6 rounded-full bg-green-100 text-green-600 flex items-center justify-center mr-3">
                            <i class="fas fa-lightbulb text-sm"></i>
                        </div>
                        <p class="text-gray-700">
                            在编写SQL语句时，应尽量使用<span class="font-bold text-green-600">#{}</span>来处理参数，只有在处理动态表名或列名等特殊场景才考虑使用<span class="font-bold">${}</span>。
                        </p>
                    </li>
                </ul>

                <div class="mt-8 bg-yellow-50 border-l-4 border-yellow-400 p-4 rounded-r-lg">
                    <div class="flex">
                        <div class="flex-shrink-0">
                            <i class="fas fa-exclamation-circle text-yellow-500"></i>
                        </div>
                        <div class="ml-3">
                            <h4 class="heading-font text-sm font-medium text-yellow-800">安全提示</h4>
                            <div class="mt-2 text-sm text-yellow-700">
                                <p>
                                    使用${}时务必确保参数值来源可信，或进行手动转义处理。对于用户输入的内容，绝对不要直接使用${}拼接！
                                </p>
                            </div>
                        </div>
                    </div>
                </div>
            </div>
        </section>

        <!-- Practical Example -->
        <section class="mb-16">
            <h2 class="heading-font text-3xl font-bold text-gray-800 mb-6 pb-2 border-b border-gray-200">实际应用场景</h2>
            
            <div class="bg-white rounded-xl shadow-sm overflow-hidden">
                <div class="grid md:grid-cols-2 divide-x divide-gray-200">
                    <div class="p-6">
                        <div class="flex items-center mb-4">
                            <div class="w-10 h-10 rounded-full bg-green-100 text-green-600 flex items-center justify-center mr-3">
                                <i class="fas fa-thumbs-up"></i>
                            </div>
                            <h3 class="heading-font text-xl font-bold text-gray-800">推荐使用#{}的场景</h3>
                        </div>
                        <ul class="space-y-3 text-gray-700">
                            <li class="flex items-start">
                                <i class="fas fa-check text-green-500 mr-2 mt-1"></i>
                                <span>用户输入的查询条件</span>
                            </li>
                            <li class="flex items-start">
                                <i class="fas fa-check text-green-500 mr-2 mt-1"></i>
                                <span>WHERE子句中的条件值</span>
                            </li>
                            <li class="flex items-start">
                                <i class="fas fa-check text-green-500 mr-2 mt-1"></i>
                                <span>INSERT/UPDATE语句中的值</span>
                            </li>
                            <li class="flex items-start">
                                <i class="fas fa-check text-green-500 mr-2 mt-1"></i>
                                <span>普通查询参数传递</span>
                            </li>
                        </ul>
                    </div>
                    <div class="p-6">
                        <div class="flex items-center mb-4">
                            <div class="w-10 h-10 rounded-full bg-yellow-100 text-yellow-600 flex items-center justify-center mr-3">
                                <i class="fas fa-exclamation"></i>
                            </div>
                            <h3 class="heading-font text-xl font-bold text-gray-800">可能需要使用${}的场景</h3>
                        </div>
                        <ul class="space-y-3 text-gray-700">
                            <li class="flex items-start">
                                <i class="fas fa-info-circle text-yellow-500 mr-2 mt-1"></i>
                                <span>动态表名（需确保表名安全）</span>
                            </li>
                            <li class="flex items-start">
                                <i class="fas fa-info-circle text-yellow-500 mr-2 mt-1"></i>
                                <span>动态列名（需确保列名安全）</span>
                            </li>
                            <li class="flex items-start">
                                <i class="fas fa-info-circle text-yellow-500 mr-2 mt-1"></i>
                                <span>ORDER BY子句（需确保排序字段安全）</span>
                            </li>
                            <li class="flex items-start">
                                <i class="fas fa-info-circle text-yellow-500 mr-2 mt-1"></i>
                                <span>SQL语句的其他不可变部分</span>
                            </li>
                        </ul>
                    </div>
                </div>
            </div>
        </section>
    </main>

    <!-- Footer -->
    <footer class="bg-gray-900 text-gray-400 py-8">
        <div class="container mx-auto px-6 max-w-4xl">
            <div class="flex flex-col md:flex-row justify-between items-center">
                <div class="mb-4 md:mb-0">
                    <h3 class="text-white text-lg font-medium">技术小馆</h3>
                    <p class="text-sm mt-1">专业的技术知识与实践经验分享</p>
                </div>
                <div>
                    <a href="http://www.yuque.com/jtostring" class="text-blue-400 hover:text-blue-300 transition-colors duration-200 flex items-center">
                        <i class="fas fa-external-link-alt mr-2"></i>
                        访问技术小馆语雀
                    </a>
                </div>
            </div>
            <div class="border-t border-gray-800 mt-8 pt-8 text-center text-sm">
                <p>© 2023 技术小馆. 保留所有权利.</p>
            </div>
        </div>
    </footer>

    <script>
        // Initialize Mermaid
        mermaid.initialize({
            startOnLoad: true,
            theme: 'default',
            flowchart: {
                useMaxWidth: false,
                htmlLabels: true,
                curve: 'basis'
            }
        });

        // Copy code functionality
        function copyCode(button) {
            const codeBlock = button.parentElement.querySelector('code');
            const range = document.createRange();
            range.selectNode(codeBlock);
            window.getSelection().removeAllRanges();
            window.getSelection().addRange(range);
            document.execCommand('copy');
            window.getSelection().removeAllRanges();
            
            // Show feedback
            const originalIcon = button.innerHTML;
            button.innerHTML = '<i class="fas fa-check"></i>';
            button.style.color = '#10B981';
            setTimeout(() => {
                button.innerHTML = originalIcon;
                button.style.color = 'rgba(255,255,255,0.5)';
            }, 1500);
        }

        // Add hover effect to code copy buttons
        document.querySelectorAll('.code-copy').forEach(button => {
            button.addEventListener('mouseenter', () => {
                button.style.color = 'white';
            });
            button.addEventListener('mouseleave', () => {
                button.style.color = 'rgba(255,255,255,0.5)';
            });
        });
    </script>
</body>
</html>
```